TwigView for CakePHP: Deserialization of untrusted data in unserialize filter
Summary
The TwigView plugin for CakePHP exposes PHP's unserialize function as a Twig template filter without restricting which classes may be instantiated. An attacker who can influence the data passed to this filter can use gadget classes available in the application to trigger code execution. The CNA rates the issue CVSS 4.0 6.9 (Medium); the vendor advisory describes it as a gadget for deserialization RCE, and exploitation depends on the gadgets present in the application.
Affected
- TwigView versions before 1.3.3
- TwigView versions 2.0.0 up to but excluding 2.1.2
- Aikido reports a wider range (1.0.0 to 1.3.2 and 2.0.0 to 2.1.1); check your installed version.
Fixed in
- Version 1.3.3
- Version 2.1.2
Workaround
- Do not use the unserialize filter in templates. Search templates for the filter first.
- No other workaround is known.
Exploitation
- No known exploitation in the wild, according to OffSeq.
- No public proof of concept found in the research.
- Unknown whether the vulnerability is listed in CISA KEV.
Our recommendation
- Check composer.lock files for cakephp/twig-view and identify affected versions.
- Search templates for the unserialize filter. If it is unused, document this and plan the upgrade.
- Upgrade to 1.3.3 or 2.1.2, testing first because the fix may break templates that deserialize PHP objects.
- Check whether the application is internet-facing and whether untrusted data can reach templates.
- Patch CVE-2026-59191 (path traversal in the same release) at the same time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-48qj-5wxh-m8hc github.com
- Fix commit 99a5940 github.com
- Pull Request #119 github.com
- Release 1.3.3 github.com
- Release 2.1.2 github.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:56.
Original description (NVD)
TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2.
NVD references (6)
- https://github.com/cakephp/twig-view/commit/99a59407b138a0efff0ce3896cbf67e71a9c9cd3
- https://github.com/cakephp/twig-view/pull/119
- https://github.com/cakephp/twig-view/pull/120
- https://github.com/cakephp/twig-view/releases/tag/1.3.3
- https://github.com/cakephp/twig-view/releases/tag/2.1.2
- https://github.com/cakephp/twig-view/security/advisories/GHSA-48qj-5wxh-m8hc
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.